Entra ID collector

Purpose

Use Entra ID logs to detect malicious authentication and privilege changes.

The Entra ID brand has replaced the Azure Active Directory brand.

The Entra ID collector works with over 2000 applications, including any application that supports a standard authentication method. Typically Entra ID is used with Microsoft’s cloud and on-premise products.

Authorize it

First, authorize an event hub. Then add Entra ID to the event hub.

1. Open Entra.

2. Switch to the directory.

   

3. Add your Entra ID diagnostic settings. Devo recommends enabling all log options.

Run it

The Entra ID collector is run the same way as an Event Hub Azure collector.

Example tables

Secure it

The Authentication alert pack works with Entra ID data.

Find privilege escalation, including roles, groups, and administrative units. Unexpected privilege escalation may indicate a user intends to exfiltrate or destroy data.

from cloud.azure.ad.audit 
where startswith(operationName,"Add"), toktains(operationName,"member to")
group by operationName as escalation_type, 
properties_initiatedBy_user_displayName as actor, 
properties_targetResources as target

A password reset or change may occur when an account is compromised.

from cloud.azure.ad.audit 
where eq(operationName,"User started password reset") or 
(weakhas(operationName,"change") and has(operationName,"password")) or 
startswith(operationName,"Reset password")

Get authentication risks detected by Microsoft.

from cloud.azure.ad.signin_all 
where not eq(risk_state,"none"), isnotnull(risk_state) 
group by user, risk_state, risk_detail